I will now ask a strange question, but bear with me. I can't share the entire usecase, but the point is to allow the holder of a secret key to create "strings" (used in other systems). The strings should be: non-reversible (=> hash) and should nobody but the key holder should be able to create them based on a known plaintext.
I know this sounds like an (H)MAC, but the goal is not message authentication.
So, to achieve that result (a non-reversible string that only the key-owner can generate), is encrypt(AES)-then-hash a good option as an alternative to HMAC?
A clarification - since it should be reproducible, the AES encryption (in CBC mode) should use a constant, rather than random initialization vector. This is in general wrong, but since the result of the encryption will be immediately hashed, the drawback of constant IV might be mitigated.
HMAC is faster than AES+hash (on my machine around 5 times), but both are fast enough for that to not be relevant.
HSMs support both encryption and HMAC. AWS KMS does not support HMAC.
Are there other drawbacks or benefits of AES+hash over HMAC? Or is there another canonical way to achieve to same goal - "irreversible result that only the key-holder can generate"
sha3(secret|string)
to create a digest?